payment pdf[.]exe | Triage

Sharing

General

Target

payment pdf.exe
Size

678KB
MD5

600803e9da620b4f9a0a54cdad882529
SHA1

5c444b2d2b1fba4ecdf494b191bcb9a0cd3f16be
SHA256

6f2062cf77ff652c364e9ef05ebccd24aa35c317b63e0bde3a33b0e480e70410
SHA512

c7d3950b2fd47708f7bfabb33d8ab1b0c2bd1fdab014d10a6eb161fff5b8b2f83d649ab0d474f9187e7b8340b7e312608a3fe2c7b5be7b28803f26db2d0b88bc
SSDEEP

12288:8UqBI7ZmO9GL3wGllh50elrQTy5GlE48:8M1mOALDHlrQTCGC48

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
payment pdf.exe

Files

payment pdf.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 676KB - Virtual size: 675KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ